Comments on: Attestation signing of Windows device driver: An unofficial guide

By: Rudy

Rudy — Tue, 19 Mar 2024 06:26:17 +0000

When I click the link to add Hardware role in Partner Center the page returns “Sorry, we couldn’t find that page”. I tried it from multiple account, from multiple browsers on multiple computers with no luck. Anyone else have this problem or know how to fix it. There is no way to get Partner Center phone help and the help ticket system seems to be inaccessible. Did the kernel driver signing method change since this article was written?

By: Budi Mulyana

Budi Mulyana — Tue, 16 Aug 2022 07:10:56 +0000

Yes, I understand now, Shipping Label is not mandatory in Submit new hardware, right? because the shipping label must select the hardware ID.

By: eli

eli — Mon, 15 Aug 2022 19:20:00 +0000

I don’t know the answer to your direct question, but the reason that drivers must be signed is that they go into the kernel, which puts the software in a position to do virtually anything it wants.

So I don’t think there’s a difference if the software needs to access hardware or not. If it goes into the kernel, I guess it needs to be signed like any other driver.

By: Budi Mulyana

Budi Mulyana — Mon, 15 Aug 2022 18:32:35 +0000

I’ve tried signing manually using signtool, and the signing was successful, but an error occurred when running it using windows service (sc start mydriver.sys), sectigo suggested it should be signed by microsoft parner center.

We develop software in the form of drivers. There is no hardware related driver. We have signed it with an EV code signing certificate from Sectigo. the program is only for monitoring file create, delete files, move files, rename files etc. is it enough to use File Sign Services (LSA) or do I have to Submit New Hardware?

By: eli

eli — Mon, 15 Aug 2022 09:43:04 +0000

You don’t. The driver is signed with Microsoft’s signature, and that does the trick.

If you really insist, you could add a second signature to the .cat file, or maybe sign the .sys files before submitting them. I don’t know if either of these will work, but even if it does, I can’t see the point: It’s still Microsoft’s signature that counts.

By: Budi Mulyana

Budi Mulyana — Mon, 15 Aug 2022 09:18:10 +0000

After submitting the complete new hardware (Submission Status is Complete) and the signed zip file has been downloaded, then how do I get my sys file signed with my EV code signing?

By: eli

eli — Thu, 28 Jul 2022 05:44:01 +0000

The name that appears in the Device Manager is set in the .inf file. As I mentioned above, the name in the submission is for your own internal use.

By: Brian Dumas

Brian Dumas — Wed, 27 Jul 2022 21:49:19 +0000

Quick question – when the driver is installed and I look under Device Manager, why does it not use the name I used in the submission?

Also, thank you so much for writing this. I searched all over and asked questions on a lot of web sites, and this article pushed me over the top. I got it signed.